السلام عليكم ورحمة الله وبركاته

ارجو المساعدة عندي نظام الويندوز windows xp professionel

كان عندي برنامج الحماية لافاست كان شغال ثم بدات المشاكل اصبح الميكرو مايغلق مباشرة كل مرة تجي ايقونة انهاء البرنامج مع المحاولة عدة مرات يغلق

ثم اختفت ايقونة الافاست ثم اصبح لا يعمل سكان لبعض الملفات

ثم نزعت البرنامج وحاولت تثبيت الويندوز8 فلم استطع

ولقد ظهر لي ميساج ان هناك ملف معطب fichier endomage

وهدا تقرير chkdsk


Le type du système de fichiers est FAT32.
Le numéro de série du volume est 148F-65CC
Windows vérifie les fichiers et les dossiers...
Windows a trouvé des erreurs sur le disque, mais ne les corrigera pas, car la
vérification de disque a été effectuée sans le paramètre /F (correction).
\System Volume Information\_restore{A803F3F2-86D9-4AB2-A691-8E21E772BA1A}\RP84\A
0259661.CFG La première unité d'allocation n'est pas valide. L'entrée sera tron
quée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\R95NR9ES\style[1].css La première unité d'allocation n'est pas valide. L'entré
e sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\R95NR9ES\ncode_imageresizer[1].js La première unité d'allocation n'est pas val
ide. L'entrée sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\R95NR9ES\Homepage_Leader;sz=728x90;ord=9190711887 611524[2] La première unité d
'allocation n'est pas valide. L'entrée sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\R95NR9ES\emn[1].swf La première unité d'allocation n'est pas valide. L'entrée
sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\R95NR9ES\CACLIR8B.net La première unité d'allocation n'est pas valide. L'entré
e sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\R95NR9ES\6cb77133f6[1].jpg La première unité d'allocation n'est pas valide. L'
entrée sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\R95NR9ES\showthread[1].php La première unité d'allocation n'est pas valide. L'
entrée sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\R95NR9ES\showthread[1].htm La première unité d'allocation n'est pas valide. L'
entrée sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\R95NR9ES\vbulletin_important[2].css La première unité d'allocation n'est pas v
alide. L'entrée sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\LGTXM59A\emn[1].js La première unité d'allocation n'est pas valide. L'entrée s
era tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\LGTXM59A\Homepage_Overlay;dcopt=ist;sz=1x1;ord=48 17920427235192[2] La première
unité d'allocation n'est pas valide. L'entrée sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\LGTXM59A\2c577c10d9[1].jpg La première unité d'allocation n'est pas valide. L'
entrée sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\LGTXM59A\yahoo-dom-event[1].js La première unité d'allocation n'est pas valide
. L'entrée sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\LGTXM59A\55f64p2xk50p[1].gif La première unité d'allocation n'est pas valide.
L'entrée sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\LGTXM59A\simplegallery[1].js La première unité d'allocation n'est pas valide.
L'entrée sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\LGTXM59A\CA0LAZ0V.swf La première unité d'allocation n'est pas valide. L'entré
e sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\LGTXM59A\cps-vfl163103[1].swf La première unité d'allocation n'est pas valide.
L'entrée sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\LGTXM59A\i_icon_mini_message[1].gif La première unité d'allocation n'est pas v
alide. L'entrée sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\LGTXM59A\i_icon_mini_logout[1].gif La première unité d'allocation n'est pas va
lide. L'entrée sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\LGTXM59A\i_back_catd[1].jpg La première unité d'allocation n'est pas valide. L
'entrée sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\LGTXM59A\index[1].htm La première unité d'allocation n'est pas valide. L'entré
e sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\LGTXM59A\i_folder_new_big[1].gif La première unité d'allocation n'est pas vali
de. L'entrée sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\LGTXM59A\CAIJWXEN.swf La première unité d'allocation n'est pas valide. L'entré
e sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\LGTXM59A\n[1].htm La première unité d'allocation n'est pas valide. L'entrée se
ra tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\LGTXM59A\CA0D6BCD.swf La première unité d'allocation n'est pas valide. L'entré
e sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\LGTXM59A\Homepage_Overlay;dcopt=ist;sz=1x1;ord=21 04332138040044[2].7 La premiè
re unité d'allocation n'est pas valide. L'entrée sera tronquée.
\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5
\LGTXM59A\CABIY9ZZ.htm La première unité d'allocation n'est pas valide. L'entré
e sera tronquée.
La taille de l'entrée \Documents and Settings\user\Local Settings\Historique\His
tory.IE5\index.dat est incorrecte.
\Documents and Settings\user\Local Settings\Temp\Cookies\user@content.yieldmanag
er[1].txt La première unité d'allocation n'est pas valide. L'entrée sera tronqu
ée.
\Documents and Settings\user\Local Settings\Temp\Temporary Internet Files\Conten
t.IE5\2345678R\sports[1].gif La première unité d'allocation n'est pas valide. L
'entrée sera tronquée.
\WINDOWS\Prefetch\CHKDSK.EXE-2CC4C59D.pf La première unité d'allocation n'est p
as valide. L'entrée sera tronquée.
Vérification des fichiers et des dossiers terminée.
Convertir les liens perdus en fichiers (O/N) ?


وهدا تقريرHijack


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:42:40, on 08/05/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\netdde.exe
C:\WINDOWS\system32\msdtc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\clipsrv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\locator.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\tlntsvr.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\dmadmin.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dz/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = // anna I Liebe YOU ==> MILK@3|_!!!
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (file missing)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealOne Player\rpbrowserrecordplugin.dll
O4 - HKLM\..\Run: [kubernesis.dll] C:\WINDOWS\kubernesis.dll.vbe
O4 - HKLM\..\Run: [kubernscan] C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\kubernscan.vbe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: netgya32.exe
O4 - Global Startup: kubernscan.vbe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

--
End of file - 4111 bytes

وانا تعبت من الفرمتة دايما عند المصلح

جزاكم الله خبرا

حبيبتى لا تقلقى مفيش مشكله من غير حل
وبعدين حضرتك اشترى نسخه ويندوز واتعلمى تسطيب الويندوز بنفسك

حضرتك اولا اعملى اصلاح لتقرير الهاى جاك الاتى:

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (file missing)

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O4 - HKLM\..\Run: [kubernesis.dll] C:\WINDOWS\kubernesis.dll.vbe

O4 - Startup: netgya32.exe

O4 - Global Startup: kubernscan.vbe

واعملى فحص للجهاز بهذه الاداه

اداه حذف الفيروسات



واحذفى نسخه الافاست اللى عند حضرتك ونزلى النسخه من هنا




وانا متابعه حضرتك فى اى شئ

وجربي فحص جهازك بهذه

http://lakii.com/vb/showthread.php?t=600540

اختي Eng.E.M.Kلقد فعلت مثلما قلت ركبت الاداة وهدا هو التقرير لكنه جد طويل ومافهمت ولاشيء

ComboFix 10-05-08.03 - user 09/05/2010 13:35:18.1.2 - FAT32x86
Microsoft Windows XP Professionnel 5.1.2600.2.1256.213.1036.18.957.644 [GMT 2:00]
Running from: c:\documents and settings\user\Mes documents\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\user\Application Data\avdrn.dat
c:\documents and settings\user\Application Data\wiaservg.log
c:\windows\system32\drivers\protect.sys
c:\windows\system32\drivers\ukbckly.sys
c:\windows\system32\Drivers\zeslwyd.sys
c:\windows\system32\fjhdyfhsn.bat

c:\windows\system32\grpconv.exe . . . is missing!!

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DARKNESS
-------\Legacy_MSUPDATE
-------\Service_protect


((((((((((((((((((((((((( Files Created from 2010-04-09 to 2010-05-09 )))))))))))))))))))))))))))))))
.

2010-05-09 08:17 . 2010-05-09 08:17 -------- d-----w- C:\FOUND.006
2010-05-07 19:26 . 2010-05-07 19:26 -------- d-----w- c:\program files\Trend Micro
2010-05-07 12:33 . 2010-05-07 12:33 -------- d-----w- C:\FOUND.005
2010-05-07 07:07 . 2010-05-07 07:07 -------- d-----w- C:\FOUND.004
2010-05-07 07:03 . 2010-05-07 07:03 -------- d-----w- C:\FOUND.003
2010-05-06 09:53 . 2010-05-06 09:53 -------- d-----w- C:\FOUND.002
2010-05-05 19:56 . 2010-05-05 19:56 -------- d-----w- C:\FOUND.001
2010-05-05 06:18 . 2010-05-05 06:18 -------- d-----w- C:\FOUND.000
2010-05-04 08:07 . 2010-05-04 08:07 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2010-05-04 07:44 . 2010-05-04 07:44 -------- d-----w- c:\documents and settings\LocalService\Bureau
2010-05-04 07:35 . 2010-05-04 07:35 -------- d-----w- C:\FOUND.036
2010-05-04 07:27 . 2010-05-04 07:27 -------- d-----w- c:\windows\ServicePackFiles
2010-05-04 07:02 . 2010-05-04 07:02 -------- d-----w- c:\windows\system32\CatRoot_bak
2010-05-04 07:00 . 2007-09-20 02:43 331184 ------w- c:\windows\system32\difxapi.dll
2010-05-04 06:52 . 2010-05-04 06:52 -------- d-----w- C:\FOUND.035
2010-05-04 06:45 . 2004-08-04 02:54 25600 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2010-05-04 06:45 . 2010-05-04 06:45 -------- d-----w- C:\FOUND.034
2010-05-04 06:37 . 2008-06-14 17:59 272768 ------w- c:\windows\system32\drivers\bthport.sys
2010-05-04 06:37 . 2008-06-14 17:59 272768 ------w- c:\windows\system32\dllcache\bthport.sys
2010-05-04 06:35 . 2010-02-24 12:31 454016 ------w- c:\windows\system32\dllcache\mrxsmb.sys
2010-05-04 06:08 . 2010-05-04 06:08 -------- d-----w- C:\FOUND.033
2010-05-04 06:00 . 2010-05-04 06:00 -------- d-----w- C:\FOUND.032
2010-05-04 05:57 . 2010-05-04 05:57 -------- d-----w- C:\FOUND.031
2010-05-04 05:51 . 2010-05-04 05:51 -------- d-----w- C:\FOUND.030
2010-05-02 20:41 . 2010-05-02 20:41 -------- d--h--w- c:\windows\$hf_mig$
2010-05-02 20:16 . 2010-02-16 19:33 2183424 ------w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-05-02 20:16 . 2010-02-16 19:32 2139136 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-05-02 20:16 . 2010-02-16 19:33 2060416 ------w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-05-02 20:16 . 2010-02-16 19:32 2018816 ------w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-05-02 14:55 . 2010-05-02 14:55 0 ----a-w- c:\windows\nsreg.dat
2010-05-02 14:54 . 2010-05-02 14:54 -------- d-----w- c:\documents and settings\user\Local Settings\Application Data\Mozilla
2010-04-30 09:18 . 2010-04-30 09:18 569344 ----a-w- c:\windows\Full_Screen_Saver_1.scr
2010-04-23 08:03 . 2010-04-23 08:03 -------- d-----w- c:\documents and settings\user\Local Settings\Application Data\Conduit
2010-04-10 14:18 . 2010-04-10 14:18 79368 ----a-w- c:\documents and settings\user\Application Data\Real\Update\setup3.10\RUP\vista.exe
2010-04-10 14:18 . 2010-04-10 14:18 64000 ----a-w- c:\documents and settings\user\Application Data\Real\Update\setup3.10\RUP\inst_config\gcapi_d ll.dll
2010-04-10 14:18 . 2010-04-10 14:18 52288 ----a-w- c:\documents and settings\user\Application Data\Real\Update\setup3.10\RUP\inst_config\gtapi.d ll
2010-04-10 14:18 . 2010-04-10 14:18 50688 ----a-w- c:\documents and settings\user\Application Data\Real\Update\setup3.10\RUP\inst_config\fftbapi .dll
2010-04-10 14:18 . 2010-04-10 14:18 49152 ----a-w- c:\documents and settings\user\Application Data\Real\Update\setup3.10\RUP\inst_config\Carboni teCompatibility.dll
2010-04-10 14:18 . 2010-04-10 14:18 118784 ----a-w- c:\documents and settings\user\Application Data\Real\Update\setup3.10\RUP\inst_config\compat. dll
2010-04-10 06:17 . 2010-05-04 06:18 439816 ----a-w- c:\documents and settings\user\Application Data\Real\Update\setup3.10\setup.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2010-05-06 10:17 . 2002-09-06 22:00 49462 ----a-w- c:\windows\system32\perfc00C.dat
2010-05-06 10:17 . 2002-09-06 22:00 370344 ----a-w- c:\windows\system32\perfh00C.dat
2010-05-04 12:52 . 2010-05-04 12:52 12 ----a-w- c:\documents and settings\LocalService\Application Data\wpignz.dat
2010-05-01 19:08 . 2010-05-01 19:08 12 ----a-w- c:\documents and settings\NetworkService\Application Data\wpignz.dat
2010-04-24 10:03 . 2010-03-03 14:15 45056 ----a-w- c:\windows\NCUNINST.EXE
2010-04-08 20:34 . 2010-04-08 20:34 203776 ----a-w- c:\windows\system32\clrviddc.dll
2010-04-08 19:49 . 2010-04-08 19:49 -------- d-----w- c:\program files\Fichiers communs\xing shared
2010-04-08 19:49 . 2010-04-08 19:49 -------- d-----w- c:\program files\Real
2010-04-05 14:52 . 2010-04-05 14:52 73216 ----a-w- c:\windows\ST6UNST.EXE
2010-03-29 16:50 . 2010-03-29 16:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Zbshareware Lab
2010-03-29 16:46 . 2010-03-29 16:46 -------- d-----w- c:\program files\USB Disk Security
2010-03-24 15:05 . 2010-03-24 15:05 -------- d-----w- c:\program files\aod
2010-03-24 15:04 . 2010-03-24 15:04 -------- d-----w- c:\program files\Fichiers communs\Real
2010-03-22 20:49 . 2010-03-22 20:49 -------- d-----w- c:\program files\Electrotank
2010-03-22 17:20 . 2010-03-22 17:20 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared
2010-03-22 17:14 . 2010-03-22 17:14 -------- d-----w- c:\program files\iWin
2010-03-22 14:00 . 2010-03-22 14:00 -------- d-----w- c:\program files\Ricochet Lost Worlds
2010-03-22 13:44 . 2010-03-22 13:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2010-03-22 13:44 . 2010-03-22 13:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-03-22 13:44 . 2010-03-22 13:44 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-03-17 10:17 . 2010-03-17 10:17 -------- d-----w- c:\documents and settings\user\Application Data\dvdcss
2010-03-10 08:03 . 2004-08-04 02:54 417792 ----a-w- c:\windows\system32\vbscript.dll
2010-02-26 06:12 . 2004-08-04 02:54 666112 ----a-w- c:\windows\system32\wininet.dll
2010-02-26 06:12 . 2004-08-04 02:54 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-02-24 12:31 . 2004-08-04 01:15 454016 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-16 19:32 . 2004-08-04 02:48 2139136 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 19:32 . 2004-08-03 22:49 2018816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 04:46 . 2004-08-04 02:54 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:01 . 2004-08-04 01:07 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
2010-02-11 09:37 . 2010-02-11 09:37 56 ---ha-w- c:\windows\system32\ezsidmv.dat
.

------- Sigcheck -------

[-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\atapi.sys
[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\drivers\atapi.sys
[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0013\DriverFi les\i386\atapi.sys
[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0014\DriverFi les\i386\atapi.sys

[-] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\asyncmac.sys
[-] 2004-08-04 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\drivers\asyncmac.sys

[-] 2008-04-14 . 16813155807C6881F4BFBF6657424659 . 25216 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\kbdclass.sys
[-] 2004-08-04 . E798705E8DC7FAB596EF6BFDF167E007 . 25216 . . [5.1.2600.2180] . . c:\windows\system32\drivers\kbdclass.sys

[-] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\ndis.sys
[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ndis.sys
[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ndis.sys

[-] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\ntfs.sys
[-] 2004-08-04 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ntfs.sys
[-] 2004-08-04 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ntfs.sys

[-] 2008-04-14 . 06B54A7B1EF7CB16BFD0E208D343FA71 . 77824 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\browser.dll
[-] 2004-08-04 . CE9DC7CC6D75515EE62CA341473EC5F3 . 77312 . . [5.1.2600.2180] . . c:\windows\system32\browser.dll
[-] 2004-08-04 . CE9DC7CC6D75515EE62CA341473EC5F3 . 77312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\browser.dll

[-] 2008-04-14 . 91E6024D6D4DCDECDB36C43ECF9BBECB . 13312 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\lsass.exe
[-] 2004-08-04 . 9F3744A5C6F49291A7A685040A013399 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lsass.exe
[-] 2004-08-04 . 9F3744A5C6F49291A7A685040A013399 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe

[-] 2008-04-14 . BE0CB143FA427D93440DED18DB8C918B . 198144 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\netman.dll
[-] 2004-08-04 . 624CF700BBFD8BE4097AAA146E6BD363 . 198144 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\netman.dll
[-] 2004-08-04 . 624CF700BBFD8BE4097AAA146E6BD363 . 198144 . . [5.1.2600.2180] . . c:\windows\system32\netman.dll

[-] 2008-04-14 . BAA0B6E647C1AD593E9BAE5CC31BCFFB . 409088 . . [6.7.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\qmgr.dll
[-] 2004-08-04 . 87424817F82CF6A7F55DAC01A20111A3 . 382464 . . [6.6.2600.2180] . . c:\windows\system32\qmgr.dll
[-] 2004-08-04 . 87424817F82CF6A7F55DAC01A20111A3 . 382464 . . [6.6.2600.2180] . . c:\windows\system32\dllcache\qmgr.dll

[-] 2008-04-14 . 460E4CE148BD07218DA0B6A3D31885A9 . 57856 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\spoolsv.exe
[-] 2004-08-04 . B4EF928E4FAD79364A80ACBA6D999934 . 57856 . . [5.1.2600.2180] . . c:\windows\system32\spoolsv.exe
[-] 2004-08-04 . B4EF928E4FAD79364A80ACBA6D999934 . 57856 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\spoolsv.exe

[-] 2008-04-14 . DD73D6B9F6B4CB630CF35B438B540174 . 512000 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\winlogon.exe
[-] 2004-08-04 . D2DE785AEAB0BB8CA4C14A8A199DBE4E . 506368 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\winlogon.exe
[-] 2004-08-04 . D2DE785AEAB0BB8CA4C14A8A199DBE4E . 506368 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe

[-] 2008-04-14 . B4AA331468315B6A174C3F0D5B3BC135 . 617472 . . [5.82] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\comctl32.dll
[-] 2008-04-14 . F92E6BEA9349D49341383F8403B4DFE5 . 1054208 . . [6.0] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\asms\60\msft\windows\commo n\controls\comctl32.dll
[-] 2004-08-04 . A53B48B5AB9A5DA76ED247D61B0B0ADD . 611328 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll
[-] 2004-08-04 . A53B48B5AB9A5DA76ED247D61B0B0ADD . 611328 . . [5.82] . . c:\windows\system32\comctl32.dll

[-] 2008-04-14 . 7A6D0B71035E123FDDA2156A25578AD3 . 62464 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\cryptsvc.dll
[-] 2004-08-04 . BDDF3723D95DC28D78B1E93119E0E6AB . 60416 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\cryptsvc.dll
[-] 2004-08-04 . BDDF3723D95DC28D78B1E93119E0E6AB . 60416 . . [5.1.2600.2180] . . c:\windows\system32\cryptsvc.dll

[-] 2008-04-14 . 0469B73DB32E5520F342C5E163AA3CCA . 110080 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\imm32.dll
[-] 2004-08-04 . 39EE5FAF56260EBB8D77A08F525EBBB4 . 110080 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\imm32.dll
[-] 2004-08-04 . 39EE5FAF56260EBB8D77A08F525EBBB4 . 110080 . . [5.1.2600.2180] . . c:\windows\system32\imm32.dll

[-] 2008-04-14 . 5C64008E661307C4A3C3C25D9086CDE7 . 19968 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\linkinfo.dll
[-] 2004-08-04 . 9D21BC0235494F2B403026A1D3619E00 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\linkinfo.dll
[-] 2004-08-04 . 9D21BC0235494F2B403026A1D3619E00 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\linkinfo.dll

[-] 2008-04-14 . 982B2C204337C3B12211E1E1D9BA8C9C . 22016 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\lpk.dll
[-] 2004-08-04 . 8C97E0E3DAA99659D4F4B44CC1F282A6 . 22016 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lpk.dll
[-] 2004-08-04 . 8C97E0E3DAA99659D4F4B44CC1F282A6 . 22016 . . [5.1.2600.2180] . . c:\windows\system32\lpk.dll

[-] 2008-04-14 . 3891413139EAABFEFE9B0CA49B5CD395 . 343040 . . [7.0.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\msvcrt.dll
[-] 2008-04-14 . D33CD21D476C3A07DD88F83850A17432 . 343040 . . [7.0.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\asms\70\msft\windows\mswin crt\msvcrt.dll
[-] 2004-08-04 . 351B1AD22FD0EC70D889766E0B4F72ED . 343040 . . [7.0.2600.2180] . . c:\windows\system32\dllcache\msvcrt.dll
[-] 2004-08-04 . 351B1AD22FD0EC70D889766E0B4F72ED . 343040 . . [7.0.2600.2180] . . c:\windows\system32\msvcrt.dll

[7] 2009-02-06 . ECD7791E0E9246CA5F218A19F3911EB9 . 408064 . . [5.1.2600.3520] . . c:\windows\SoftwareDistribution\Download\fd39c169e 8cb784cefd1d3b2f372297e\sp2qfe\netlogon.dll
[7] 2009-02-06 . ECD7791E0E9246CA5F218A19F3911EB9 . 408064 . . [5.1.2600.3520] . . c:\windows\SoftwareDistribution\Download\e5d538fd9 a974271877bfc69f00e1e0a\sp2qfe\netlogon.dll
[7] 2009-02-06 . ECD7791E0E9246CA5F218A19F3911EB9 . 408064 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[7] 2009-02-06 . ECD7791E0E9246CA5F218A19F3911EB9 . 408064 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB975467\SP2QFE\netlogon.dll
[-] 2008-04-14 . 04821179C3171554C1BD1F9888A113E2 . 407040 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\netlogon.dll
[-] 2004-08-04 . FAF07FDCDE76000621A28D19F8E2E8EB . 407040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\netlogon.dll
[-] 2004-08-04 . FAF07FDCDE76000621A28D19F8E2E8EB . 407040 . . [5.1.2600.2180] . . c:\windows\system32\netlogon.dll

[-] 2010-02-17 . ADDA825853063A00D75D66188C3F1449 . 2192000 . . [5.1.2600.5938] . . c:\windows\SoftwareDistribution\Download\42ba2b16b df4d1bc7681514f0963d870\SP3GDR\ntoskrnl.exe
[-] 2010-02-17 . ADDA825853063A00D75D66188C3F1449 . 2192000 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3GDR\ntoskrnl.exe
[-] 2010-02-16 . 09BAD7AEF2E1AC4FC87D554FA93964A9 . 2183424 . . [5.1.2600.3670] . . c:\windows\system32\dllcache\ntoskrnl.exe
[-] 2010-02-16 . 09BAD7AEF2E1AC4FC87D554FA93964A9 . 2183424 . . [5.1.2600.3670] . . c:\windows\Driver Cache\i386\ntoskrnl.exe
[-] 2010-02-16 . 09BAD7AEF2E1AC4FC87D554FA93964A9 . 2183424 . . [5.1.2600.3670] . . c:\windows\SoftwareDistribution\Download\42ba2b16b df4d1bc7681514f0963d870\SP2GDR\ntoskrnl.exe
[-] 2010-02-16 . 0193DE7DCCCE21AA10B4FC6694E4EBF6 . 2139136 . . [5.1.2600.3670] . . c:\windows\system32\ntoskrnl.exe
[-] 2010-02-16 . CA357A9B6DB4CDFEB23C6DF54509C98E . 2188928 . . [5.1.2600.3670] . . c:\windows\SoftwareDistribution\Download\42ba2b16b df4d1bc7681514f0963d870\SP2QFE\ntoskrnl.exe
[-] 2010-02-16 . CA357A9B6DB4CDFEB23C6DF54509C98E . 2188928 . . [5.1.2600.3670] . . c:\windows\$hf_mig$\KB979683\SP2QFE\ntoskrnl.exe
[-] 2010-02-16 . 126C8FD13731649A7CD6F0A311CD49B8 . 2192128 . . [5.1.2600.5938] . . c:\windows\SoftwareDistribution\Download\42ba2b16b df4d1bc7681514f0963d870\SP3QFE\ntoskrnl.exe
[-] 2010-02-16 . 126C8FD13731649A7CD6F0A311CD49B8 . 2192128 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntoskrnl.exe
[7] 2009-02-10 . BEF458B8424553279E95E250D1E0CE7E . 2191232 . . [5.1.2600.5755] . . c:\windows\SoftwareDistribution\Download\284fbcf1e 8e0b40c0953d6b85a551eae\SP3QFE\ntoskrnl.exe
[7] 2009-02-10 . BEF458B8424553279E95E250D1E0CE7E . 2191232 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[7] 2009-02-09 . 4183ED119200F8520F5E834498AFB927 . 2182528 . . [5.1.2600.3520] . . c:\windows\SoftwareDistribution\Download\284fbcf1e 8e0b40c0953d6b85a551eae\SP2GDR\ntoskrnl.exe
[7] 2009-02-09 . B55AA66BC9269BC5257B915FFDAA790B . 2188160 . . [5.1.2600.3520] . . c:\windows\SoftwareDistribution\Download\284fbcf1e 8e0b40c0953d6b85a551eae\SP2QFE\ntoskrnl.exe
[7] 2009-02-09 . B55AA66BC9269BC5257B915FFDAA790B . 2188160 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB956572\SP2QFE\ntoskrnl.exe
[7] 2009-02-09 . AB896577F35CF5FED7A9F87D3C3205ED . 2191104 . . [5.1.2600.5755] . . c:\windows\SoftwareDistribution\Download\284fbcf1e 8e0b40c0953d6b85a551eae\SP3GDR\ntoskrnl.exe
[7] 2009-02-09 . AB896577F35CF5FED7A9F87D3C3205ED . 2191104 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\ntoskrnl.exe
[-] 2008-04-14 . 099D639DA1EF6968D4E41795BB507E6B . 2191104 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\ntoskrnl.exe
[-] 2004-08-04 . 36F32A5A83DF734E022734D93860A9A4 . 2150400 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB979683$\ntoskrnl.exe

[-] 2008-04-14 . 9F2C862E39BF8E8FC51C3F6A6BCEB415 . 17408 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\powrprof.dll
[-] 2004-08-04 . B02E4DDBE0E98F42F3B61292DDB3A104 . 17408 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\powrprof.dll
[-] 2004-08-04 . B02E4DDBE0E98F42F3B61292DDB3A104 . 17408 . . [6.00.2900.2180] . . c:\windows\system32\powrprof.dll

[-] 2008-04-14 . 973B36634C544948C663E8269AA1B3A3 . 187392 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\scecli.dll
[-] 2004-08-04 . DEC0397F35D027874804EC72979D03CC . 186368 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\scecli.dll
[-] 2004-08-04 . DEC0397F35D027874804EC72979D03CC . 186368 . . [5.1.2600.2180] . . c:\windows\system32\scecli.dll

[-] 2008-04-14 . 9A4E7ECBB5B7FB86F3B926AB039F4FEC . 5120 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\sfc.dll
[-] 2004-08-04 . 94559DE281DADCB58E6A3919C7EAC0B4 . 5120 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfc.dll
[-] 2004-08-04 . 94559DE281DADCB58E6A3919C7EAC0B4 . 5120 . . [5.1.2600.2180] . . c:\windows\system32\sfc.dll

[-] 2008-04-14 . E4BDF223CD75478BF44567B4D5C2634D . 14336 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\svchost.exe
[-] 2004-08-04 . 1BD6C2F707A275CB7C16FD99FE0F31CA . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\svchost.exe
[-] 2004-08-04 . 1BD6C2F707A275CB7C16FD99FE0F31CA . 14336 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe

[-] 2008-04-14 . 8E5231171AD6595FF002E848CC54FCD7 . 249856 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\tapisrv.dll
[-] 2004-08-04 . 2490CAE37DB8B6EC55E7A9415473D0AB . 246272 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\tapisrv.dll
[-] 2004-08-04 . 2490CAE37DB8B6EC55E7A9415473D0AB . 246272 . . [5.1.2600.2180] . . c:\windows\system32\tapisrv.dll

[-] 2008-04-14 . E853F84D3CE2FAA2A802E33CF89AC023 . 579584 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\user32.dll
[-] 2004-08-04 . E46FB493E3B33704F0715020CF52106B . 578048 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\user32.dll
[-] 2004-08-04 . E46FB493E3B33704F0715020CF52106B . 578048 . . [5.1.2600.2180] . . c:\windows\system32\user32.dll

[-] 2008-04-14 . E74DDB12188C2FF57A78624DBF7332FC . 26624 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\userinit.exe
[-] 2004-08-04 . D6D65EA32B190401B57EDB6706F29669 . 25088 . . [5.1.2600.2180] . . c:\windows\system32\userinit.exe
[-] 2004-08-04 . D6D65EA32B190401B57EDB6706F29669 . 25088 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\userinit.exe

[-] 2008-04-14 . FB836F9E62D82904C983AD21296A5D9C . 82432 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\ws2_32.dll
[-] 2004-08-04 . BC41F51A39D3B255805FDB759B7814AE . 82944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ws2_32.dll
[-] 2004-08-04 . BC41F51A39D3B255805FDB759B7814AE . 82944 . . [5.1.2600.2180] . . c:\windows\system32\ws2_32.dll

[-] 2008-04-14 . F2317622D29F9FF0F88AEECD5F60F0DD . 1037824 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\explorer.exe
[-] 2004-08-04 . 4C33E5B9A6197B6ED215F6CFBA0A2DAA . 1036288 . . [6.00.2900.2180] . . c:\windows\explorer.exe
[-] 2004-08-04 . 4C33E5B9A6197B6ED215F6CFBA0A2DAA . 1036288 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\explorer.exe

[-] 2008-04-14 . 6ED29124A1C83BD0CF6B26BD01CA6F6F . 171520 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\srsvc.dll
[-] 2004-08-04 . 6469C53F4D16FA6055CCA265BC03DB66 . 171008 . . [5.1.2600.2180] . . c:\windows\system32\srsvc.dll
[-] 2004-08-04 . 6469C53F4D16FA6055CCA265BC03DB66 . 171008 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\srsvc.dll

[-] 2008-04-14 . 02DA31AB433A6C1110A736C85701DECA . 13824 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\wscntfy.exe
[-] 2004-08-04 . 54CDDAD404557ED98433D6ECBFC92691 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe
[-] 2004-08-04 . 54CDDAD404557ED98433D6ECBFC92691 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\wscntfy.exe

[-] 2008-04-14 . F92A87FDDA0C11C8604FBC2B864FA726 . 129024 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\xmlprov.dll
[-] 2004-08-04 . 21056AEF44322C3E2DD5391B6AEFA75A . 129536 . . [5.1.2600.2180] . . c:\windows\system32\xmlprov.dll
[-] 2004-08-04 . 21056AEF44322C3E2DD5391B6AEFA75A . 129536 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\xmlprov.dll

[-] 2008-04-14 . 4EC800BDF80521B0207BD2301DFC7D14 . 56320 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\eventlog.dll
[-] 2004-08-04 . 21E83876A6287F15538EF187D286FE11 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\eventlog.dll
[-] 2004-08-04 . 21E83876A6287F15538EF187D286FE11 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\eventlog.dll

[-] 2008-04-14 . E17C85D5B5CF477638433B851A98499E . 1571840 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\sfcfiles.dll
[-] 2004-08-04 . ACF04FB3448D2C2CD3A851C138EC8AB6 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfcfiles.dll
[-] 2004-08-04 . ACF04FB3448D2C2CD3A851C138EC8AB6 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll

[-] 2008-04-14 . 59DC5BB82E4C8E0B3EADCFDBC44BA6E4 . 15360 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\ctfmon.exe
[-] 2004-08-04 . 5584247B568C2E53934873F4B655FE6A . 15360 . . [5.1.2600.2180] . . c:\windows\system32\ctfmon.exe
[-] 2004-08-04 . 5584247B568C2E53934873F4B655FE6A . 15360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ctfmon.exe

[-] 2008-04-14 . B9F20D71E5B6CE89A7A94B38351FDBDC . 135680 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\shsvcs.dll
[-] 2004-08-04 . B590E69A45AE8FCBF7DDADE89CCE3588 . 135168 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\shsvcs.dll
[-] 2004-08-04 . B590E69A45AE8FCBF7DDADE89CCE3588 . 135168 . . [6.00.2900.2180] . . c:\windows\system32\shsvcs.dll

[-] 2008-04-14 . E598D81197E2E0EC42A0C55772BB00E8 . 59904 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\regsvc.dll
[-] 2004-08-04 . 345D02087F5696749C6120359B1E2988 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\regsvc.dll
[-] 2004-08-04 . 345D02087F5696749C6120359B1E2988 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\regsvc.dll

[-] 2008-04-14 . 55F5C5C1BE1A78E285033E432BA01597 . 194560 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\schedsvc.dll
[-] 2004-08-04 . 4612EC6DAF695B87A2529FCBB95B75DE . 193024 . . [5.1.2600.2180] . . c:\windows\system32\schedsvc.dll
[-] 2004-08-04 . 4612EC6DAF695B87A2529FCBB95B75DE . 193024 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\schedsvc.dll

[-] 2008-04-14 . EA9E0DB8684CEF2FD3BADD671DF5A112 . 71680 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\ssdpsrv.dll
[-] 2004-08-04 . B636478A2569AE69CAF003254022A742 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\ssdpsrv.dll
[-] 2004-08-04 . B636478A2569AE69CAF003254022A742 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ssdpsrv.dll

[-] 2008-04-14 . 710BC85A8C22626EE094439E3EA0D38C . 297984 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\termsrv.dll
[-] 2004-08-04 . 7D521B8CF926459E270D18C559323815 . 297984 . . [5.1.2600.2180] . . c:\windows\system32\termsrv.dll
[-] 2004-08-04 . 7D521B8CF926459E270D18C559323815 . 297984 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\termsrv.dll

[-] 2008-04-14 . F36C9F78FC902C8DCE4D3B576BB0435A . 176640 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\appmgmts.dll
[-] 2004-08-04 . CE66077813D83C2D6908CDC64AE7E55A . 176640 . . [5.1.2600.2180] . . c:\windows\system32\appmgmts.dll
[-] 2004-08-04 . CE66077813D83C2D6908CDC64AE7E55A . 176640 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\appmgmts.dll

[-] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\aec.sys
[-] 2004-08-03 20:39 . 841F385C6CFAF66B58FBD898722BB4F0 . 142464 . . [5.1.2601.2078] . . c:\windows\system32\drivers\aec.sys

[-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\ip6fw.sys
[-] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ip6fw.sys
[-] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ip6fw.sys

[-] 2008-04-14 . E67A66A3781C1A483F0F8992664CBE0D . 33792 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\msgsvc.dll
[-] 2004-08-04 . 97939358ED4487CBB4A0D743CE958266 . 33792 . . [5.1.2600.2180] . . c:\windows\system32\msgsvc.dll
[-] 2004-08-04 . 97939358ED4487CBB4A0D743CE958266 . 33792 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\msgsvc.dll

[-] 2004-08-10 23:45 . A477391B7A8B0A0DAABADB17CF533A4B . 25088 . . [10.0.3790.3646] . . c:\windows\system32\MsPMSNSv.dll
[-] 2004-08-10 23:45 . A477391B7A8B0A0DAABADB17CF533A4B . 25088 . . [10.0.3790.3646] . . c:\windows\system32\dllcache\mspmsnsv.dll
[-] 2004-08-10 23:45 . A477391B7A8B0A0DAABADB17CF533A4B . 25088 . . [10.0.3790.3646] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll
[-] 2004-08-04 02:54 . 762B2A5F0E8B0164A5DB6741959DFB0C . 52736 . . [9.0.1.56] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSNSv.dll

[-] 2010-02-17 . 0757B640C97B21A44333E786D40526F6 . 2065792 . . [5.1.2600.3670] . . c:\windows\SoftwareDistribution\Download\42ba2b16b df4d1bc7681514f0963d870\SP2QFE\ntkrnlpa.exe
[-] 2010-02-17 . 0757B640C97B21A44333E786D40526F6 . 2065792 . . [5.1.2600.3670] . . c:\windows\$hf_mig$\KB979683\SP2QFE\ntkrnlpa.exe
[-] 2010-02-16 . 0307EE44C18CF9D17D90061DE351DB8C . 2060416 . . [5.1.2600.3670] . . c:\windows\system32\dllcache\ntkrnlpa.exe
[-] 2010-02-16 . 0307EE44C18CF9D17D90061DE351DB8C . 2060416 . . [5.1.2600.3670] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe
[-] 2010-02-16 . 0307EE44C18CF9D17D90061DE351DB8C . 2060416 . . [5.1.2600.3670] . . c:\windows\SoftwareDistribution\Download\42ba2b16b df4d1bc7681514f0963d870\SP2GDR\ntkrnlpa.exe
[-] 2010-02-16 . 15565D206EA1531F6BCFBF7EAA571F19 . 2018816 . . [5.1.2600.3670] . . c:\windows\system32\ntkrnlpa.exe
[-] 2010-02-16 . 4394E451E25D9A01344D91BB16CF35CB . 2068864 . . [5.1.2600.5938] . . c:\windows\SoftwareDistribution\Download\42ba2b16b df4d1bc7681514f0963d870\SP3GDR\ntkrnlpa.exe
[-] 2010-02-16 . 4394E451E25D9A01344D91BB16CF35CB . 2068864 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3GDR\ntkrnlpa.exe
[-] 2010-02-16 . 6CB7C9A8C7103FEA51B0D478128CEFC0 . 2068992 . . [5.1.2600.5938] . . c:\windows\SoftwareDistribution\Download\42ba2b16b df4d1bc7681514f0963d870\SP3QFE\ntkrnlpa.exe
[-] 2010-02-16 . 6CB7C9A8C7103FEA51B0D478128CEFC0 . 2068992 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntkrnlpa.exe
[7] 2009-02-10 . F751E041E682F53EAF34F7FAEA78994D . 2068096 . . [5.1.2600.5755] . . c:\windows\SoftwareDistribution\Download\284fbcf1e 8e0b40c0953d6b85a551eae\SP3GDR\ntkrnlpa.exe
[7] 2009-02-10 . F751E041E682F53EAF34F7FAEA78994D . 2068096 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\ntkrnlpa.exe
[7] 2009-02-09 . 663D7167ED065786EC9DCFF2569A39F7 . 2059776 . . [5.1.2600.3520] . . c:\windows\SoftwareDistribution\Download\284fbcf1e 8e0b40c0953d6b85a551eae\SP2GDR\ntkrnlpa.exe
[7] 2009-02-09 . 0150FE5C1E07F8AE422FEC6C8E8A0C98 . 2065024 . . [5.1.2600.3520] . . c:\windows\SoftwareDistribution\Download\284fbcf1e 8e0b40c0953d6b85a551eae\SP2QFE\ntkrnlpa.exe
[7] 2009-02-09 . 0150FE5C1E07F8AE422FEC6C8E8A0C98 . 2065024 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB956572\SP2QFE\ntkrnlpa.exe
[7] 2009-02-09 . ED5E20AE4AC5A63A4FF43FFE704A5153 . 2068224 . . [5.1.2600.5755] . . c:\windows\SoftwareDistribution\Download\284fbcf1e 8e0b40c0953d6b85a551eae\SP3QFE\ntkrnlpa.exe
[7] 2009-02-09 . ED5E20AE4AC5A63A4FF43FFE704A5153 . 2068224 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
[-] 2008-04-14 . B71A8F101CEFAF82FC5EC16130A54A3F . 2067968 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\ntkrnlpa.exe
[-] 2004-08-04 . 35567C8C50986C2BC5C3EFD79CB045E4 . 2017280 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB979683$\ntkrnlpa.exe

[-] 2008-04-14 02:33 . 037D92B3A7853A183FCAB77FB1D13D6C . 438272 . . [5.1.2400.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\ntmssvc.dll
[-] 2004-08-04 02:54 . 3F82A4226289510DF300813B9B87F0E5 . 438272 . . [5.1.2400.2180] . . c:\windows\system32\ntmssvc.dll
[-] 2004-08-04 02:54 . 3F82A4226289510DF300813B9B87F0E5 . 438272 . . [5.1.2400.2180] . . c:\windows\system32\dllcache\ntmssvc.dll

[-] 2008-04-14 . BD8166A495B02308F364B36249475F22 . 186368 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\upnphost.dll
[-] 2004-08-04 . 168AE9938F6BE31D198AF92496CCFA33 . 185344 . . [5.1.2600.2180] . . c:\windows\system32\upnphost.dll
[-] 2004-08-04 . 168AE9938F6BE31D198AF92496CCFA33 . 185344 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\upnphost.dll

[-] 2008-04-14 . 4BB396EA6CAA50F2208078602549F2F2 . 367616 . . [5.3.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f 3830b5acec68906a2aac4ab\dsound.dll
[-] 2004-08-04 . 0AE00CA307264649EE2F5FC1CB1B0F1F . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dsound.dll
[-] 2004-08-04 . 0AE00CA307264649EE2F5FC1CB1B0F1F . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dllcache\dsound.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2010-04-08 198160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\user\Menu D‚marrer\Programmes\D‚marrage\
netgya32.exe [2004-8-4 15872]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2008-09-29 15:57 21755688 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [07/01/2009 23:39 20744]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [04/02/2010 13:25 13696]
S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [02/07/2008 14:58 26248]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.dz/
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

************************************************** ************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-09 13:43
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1390067357-1659004503-839522115-1003\Software\Microsoft\SystemCertificates\Address Book*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3136)
c:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\SCardSvr.exe
c:\windows\system32\netdde.exe
c:\windows\system32\msdtc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\imapi.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\msiexec.exe
c:\program files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
c:\windows\system32\sessmgr.exe
c:\windows\system32\locator.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\FULL_S~1.SCR
.
************************************************** ************************
.
Completion time: 2010-05-09 13:46:40 - machine was rebooted
ComboFix-quarantined-files.txt 2010-05-09 11:46

Pre-Run: 8 743 321 600 octets libres
Post-Run: 8 957 411 328 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professionnel" /noexecute=optin /fastdetect

- - End Of File - - 7A2B97E2AB0C4990AFB07878985CC815

اختي انا عندي نسخة الويندوز جاءت مع الكومبيوتر والله اعلم ان كانت مزيفة ام لا

هل باستطاعتي الان تركيب anti virus

لقد اكثرت عليك فمعدرة وجزاك الله الجنة

اخي الخبراء العرب هل ااستعمل هده الاداة بعدما حملت اداة الComboFixوهل لها نفس الاستعمال

ارجو المساعدة جزاكم الله الجنة

الأداتين ممتازين سواء اللي وضعتها ولا اللي وضعتها EMK
افحصي جهازك فيهم

بارك الله فيك اخي و في الاخت EMKلقد فحصت الجهاز هل باستطاعتي الان تثبيت الanti virus

لقد وجدت ايقونةاللغات اختفت كيف لي اضهارها من جديد

حبيبتى تقدرى دلوقتى تسطبى الانتى فيرس
انا فحصت التقرير وهو كدا تمام اتصرف هو مع المشاكل اللى عند حضرتك
ابدئى الان فى التسطيب

بالنسبه لاظهار اللغه
ادخلى على لوحه التحكم الكنترول بانل من قائمه ستارت
واختارى اعدادات اللغه Language and Regions

هتظهر الشاشه دى طبقى مثل الصور
هتضغطى على رقم 1



وتضغطى صح على الخيار رقم 3

الله يبارك فيك ويوفقك دينا ودنيا